[Security] tar-slip in image layer file extraction (arbitrary file write on the analyst's machine)

As project seem to be inactive, I proceed with a public disclosure.

Summary

A tar-slip in dive's "extract file" feature writes attacker-chosen paths on the analyst's machine when they extract a file from a malicious Docker image layer. The only validation on tar entry names is a string prefix check, so ../ sequences (or any path sharing the prefix) write anywhere relative to the working directory.

Details

dive/image/docker/image_archive.go:337-375 (extractInner, reached from the interactive extract keybinding via onFileTreeViewExtract -> engineResolver.Extract -> ExtractFromImage):

func extractInner(reader *tar.Reader, p string) error {
	target := strings.TrimPrefix(p, "/")
	...
	name := header.Name
	switch header.Typeflag {
	case tar.TypeReg:
		if strings.HasPrefix(name, target) {
			err := os.MkdirAll(filepath.Dir(name), 0755)
			...
			out, err := os.Create(name)

header.Name comes from the image layer being inspected; p is the selected tree path. The prefix check offers no containment: a crafted entry named etc/motd/../../../home/victim/.bashrc passes HasPrefix(name, "etc/motd"), and os.Create uses the name raw, relative to the working directory where dive runs (typically the analyst's project/home). There is no filepath.Clean, no .. rejection, no containment root, no symlink check, no size cap. Analyzing third-party images is dive's core use case, so the layer content is fully attacker-controlled.

Found by my Go static analyzer (taint analysis), exact report lines on current master:

dive/image/docker/image_archive.go:357:23: [path-traversal] untrusted data from tar archive member name flows into make directory tree (confidence: 9.0/10, CWE-22)
dive/image/docker/image_archive.go:362:26: [path-traversal] untrusted data from tar archive member name flows into create file (confidence: 9.0/10, CWE-22)

Impact

CWE-22 path traversal / arbitrary file write as the analyst, triggered by publishing a crafted image and waiting for a dive user to extract from it. Leads to code execution on next shell/login. Social precondition (analyst must use the extract keybinding on the crafted image), hence medium not high.

CVSS: 6.8 / CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H CWE IDs: CWE-22, CWE-59

Internal Tracking ID: KF-202693701